Re: Restarting a Snort box

[Joel Esler <joel.esler () sourcefire com>]

Timothy,

You need to start by tuning your variables in your snort.conf,  
turning off rules that don't apply to you (ex.  Do you run pop3?   
No?  Then turn off pop3.rules).

That will give you a great starting point.

Joel

On Aug 9, 2006, at 11:22 AM, Timothy A. Holmes wrote:

> Hi folks:
>
> I admit I’m a bit embarrassed to admit it, but I have neglected my  
> snort box for several months, and it has been running along quite  
> nicely but I haven’t looked at it or BASE in probably 5 months –  
> yes, I know – irresponsiable etc – the root cause is OVERLOAD of  
> work – but that’s another story.  What I need is some help getting  
> it back to useability and then finding out how to make it useable  
> in such a way that I can glean the info I need from it quickly and  
> be able to use it when its actually useful.
>
>
>
> The box is located on the perimeter of our network just inside the  
> firewall.  The database is running internal to the system, and I am  
> Running BASE.  I will be upgrading snort and base to the latest  
> versions shortly and those type things. Im on Gentoo Linux.  I need  
> help from there
>
>
>
> Thanks
>
>
>
>
>
> Timothy A. Holmes
>
> IT Manager / Network Admin / Web Master / Computer Teacher
>
>
>
> Medina Christian Academy
>
> A Higher Standard...
>
>
>
> Jeremiah 33:3
>
> Jeremiah 29:11
>
> Esther 4:14
>
> ---------------------------------------------------------------------- 
> ---
> Using Tomcat but need to do more? Need to support web services,  
> security?
> Get stuff done quickly with pre-integrated technology to make your  
> job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache  
> Geronimo
> http://sel.as-us.falkag.net/sel? 
> cmd=lnk&kid=120709&bid=263057&dat=121642______________________________ 
> _________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

+---------------------------------------------------------------------+
Joel Esler          Senior Security Consultant         1-706-627-2101
Sourcefire    Security for the /Real/ World -- http://www.sourcefire.com
        Snort - Open Source Network IPS/IDS -- http://www.snort.org
          GPG Key: http://demo.sourcefire.com/jesler.pgp.key
            AIM:eslerjoel  YMSG:eslerjoel Gtalk:eslerj
+---------------------------------------------------------------------+



-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users